I didn't specify certificates in the filebeat config. In my config there is only the path to the osqueryd log, the input_type and document_type are both set to log, and logstash is set to be the output with the host I am trying to send to.